Not the official Binance website. Not affiliated with Binance. Content is compiled from public sources, may be incomplete or contain errors, and is updated as sources change.

Binance Attack Tracker

Fund flow

Where the money went, address by address. Each action has a public source and a mark that shows how far this site checked it. Amounts are not converted or added up.

71actions
150addresses
37re-read on the chain
29from reports
5unverified
0deposits to exchanges found

No transfer to an exchange has been reported by the sources used here. Details under “What the record shows”.

How to read the map: colours and check marks

Action colours

  • Transfer Coins or tokens move between addresses
  • Swap One asset is exchanged for another
  • Lend Assets are supplied to a lending market or borrowed against
  • Cross-chain Assets move to another blockchain
  • Authorize A wallet signs an authorization; no token moves
  • Freeze An issuer blocks an address; the tokens cannot move
  • Rescue A network authority moves the assets out of the attacker's reach
  • To exchange Assets are deposited to an exchange

Check status (the mark on each label)

  • Chain-checked This site re-read the transaction or address on a public node or API.
  • Two reports Two independent publishers describe it. Not re-read on the chain.
  • One report One publisher describes it and names the addresses. Not re-read on the chain.
  • Unverified No address or transaction that a reader can look up, or sources disagree.

Moving dots show the direction of a transfer that a source describes. Unverified actions are dotted and still. A green tick on an address means this site re-read its balance or history.

Ethereum: takeover and first sweeps

13 actions9 chain-checked3 two reports1 one report

Ethereum: about $3.79B at theft-time prices, including 200,630 ETH and 185 other tokens (1.875B USDT, 823M USDC, 88.5M RLUSD). TRM Labs analysis

ORIGIN+1 HOP+2 HOPS+3 HOPS ✓TRANSFER28,006 ETH ✓TRANSFER780M USDC ✓DEPLOYsweeper ✓TRANSFER200M USDT + 13 ✓TRANSFER167k ETH + USDT 2TRANSFER3 small txs ✓REVOKEset to zero ✓AUTHORIZE50 auths 2TRANSFERtokensBinance 16, 0xDFd5293D8e347dFe59E90eFd55b2956a1343963dBinance 160xDFd529…963dBinance Hot Wallet 34, 0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055Binance HW 340xEe7aE8…4055Tornado Cash (mixer)Tornado CashserviceOperator wallet, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0Operator wallet0x7C8601…5CA0Binance 14, 0x28C6c06298d514Db089934071355E5743bf21d60Binance 140x28C6c0…1d60Second receiver, 0xa97bf7836f8a08f9ed91d41453d371493fae8d10Second receiver0xa97bf7…8d10Sweeper contract, 0x63e842B054Bd624a465454D533C33F573e9c6fAeSweeper contract0x63e842…6fAeMain receiver, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8cMain receiver0x5227f6…2f8c✓FROZEN · World LibertyWLFIFROZEN · Tether971.1M USDTFROZEN · Circle823M USDCFROZEN · World Liberty27.8M USD1
Actions in time order (13)
  1. Deploy
    Operator wallet 0x7C8601…5CA0 Sweeper contract 0x63e842…6fAe
    Sweeper contract createdContract
    Chain-checked Analyst / chain data
    Details and sources

    The operator first rehearsed the same steps on three wallets it controlled, moving $2 to $6 each time (Blockaid).

    Ethereum transaction 0x97408e…329c

    Re-read on the chain (2026-10-31 02:21 UTC): block 26299449 at 2026-10-29T15:59:11Z; status success; sender matches; recipient matches; time matches; creates the stated contract

    Sources: Blockaid investigation · Bitquery investigation · Etherscan: transaction · as of 2026-10-30 12:28 UTC

  2. Authorize
    Operator wallet 0x7C8601…5CA0 Binance 14 0x28C6c0…1d60
    50 authorizations signed with the Binance 14 keyEIP-7702
    Chain-checked Analyst / chain data
    Details and sources

    One authorization per transaction count (nonce) 18,914,775 to 18,914,824. One matched. The chain shows all 50 point to the sweeper contract.

    Ethereum transaction 0xad9926…298b

    Re-read on the chain (2026-10-31 02:21 UTC): block 26300753 at 2026-10-29T20:20:59Z; status success; sender matches; recipient matches; time matches; tx type 0x4; 50 authorizations for nonces 18914775-18914824 all pointing to the stated contract

    Sources: Blockaid investigation · Bitquery investigation · TRM Labs analysis · Etherscan: transaction · as of 2026-10-30 12:28 UTC

  3. Transfer
    Binance 14 0x28C6c0…1d60 Main receiver 0x5227f6…2f8c
    167,464 ETH + 1.615B USDT + 62 other tokensETH, USDT, 62 other tokens
    Chain-checked Analyst / chain data
    Details and sources

    Called by the operator on the delegated wallet. About $2.5B at the time (Blockaid). The ETH amount is from the reports; the chain check covers the USDT transfers.

    Ethereum transaction 0x53bd38…e2f3

    Re-read on the chain (2026-10-31 02:21 UTC): block 26300770 at 2026-10-29T20:24:23Z; status success; sender matches; recipient matches; time matches; USDT transferred 1,615,409,499 Scope: Transaction identity, sender, recipient, time and the USDT transfer logs. The ETH amount and the other 62 tokens come from reports and were not re-read.

    Sources: Blockaid investigation · Bitquery investigation · TRM Labs analysis · Etherscan: transaction · as of 2026-10-30 12:28 UTC

  4. Transfer
    Binance 16 0xDFd529…963d Main receiver 0x5227f6…2f8c
    28,005.6 ETHETH
    Chain-checked Analyst / chain data
    Details and sources

    Ordinary signed transfer, no delegation. Blockaid also lists 55.7M USDT, 25.9M RLUSD and 84.5 WBTC for Binance 16; those tokens are not in this transaction's logs, so they moved in other transactions that the reports do not give.

    Ethereum transaction 0x51f263…d39f

    Re-read on the chain (2026-10-31 02:21 UTC): block 26300772 at 2026-10-29T20:24:47Z; status success; sender matches; recipient matches; time matches; value 28,006 ETH

    Sources: Blockaid investigation · Bitquery investigation · TRM Labs analysis · Etherscan: transaction · as of 2026-10-30 12:28 UTC

  5. Transfer
    Binance Hot Wallet 34 0xEe7aE8…4055 Main receiver 0x5227f6…2f8c
    780M USDCUSDC
    Chain-checked Analyst / chain data
    Details and sources

    The operator called the still-delegated Binance 14, which owns this smart account. Blockaid adds a second transfer of 43M USDC (823M in total); its hash is not given.

    Ethereum transaction 0xdc102d…7481

    Re-read on the chain (2026-10-31 02:21 UTC): block 26300855 at 2026-10-29T20:41:23Z; status success; sender matches; recipient matches; time matches; USDC transferred 780,000,000

    Sources: Blockaid investigation · Bitquery investigation · Blockaid live fund-flow map · Etherscan: transaction · as of 2026-10-30 12:28 UTC

  6. 20:57 UTC, the first freeze of the night (Bitquery)
    Freeze
    World Liberty Financial 🔒→ Main receiver 0x5227f6…2f8c
    WLFI token frozen (amount not stated)WLFI
    One report Analyst / chain data
    Details and sources

    Sources: Bitquery investigation · as of 2026-10-30 12:28 UTC

  7. 21:01 UTC, 37 minutes after the main sweep (TRM, Bitquery)
    Freeze
    Tether (issuer) 🔒→ Main receiver 0x5227f6…2f8c
    971.1M USDT frozen at first (1.175B USDT held later)USDT
    Chain-checked Analyst / chain data
    Details and sources

    Later sweeps landed in the frozen wallet, which then held 1.175B USDT (TRM). The Tether CEO posted at 21:25 UTC that more than 1.567B USDT was frozen.

    Re-read on the chain (2026-10-31 02:21 UTC): USDT contract lists the address as blocked (frozen) at check time

    Sources: TRM Labs analysis · Bitquery investigation · Tether CEO post (X) · as of 2026-10-30 12:28 UTC

  8. 21:04 UTC, three minutes after Tether (Bitquery)
    Freeze
    Circle (issuer) 🔒→ Main receiver 0x5227f6…2f8c
    823M USDC frozenUSDC
    Chain-checked Analyst / chain data
    Details and sources

    Circle froze it before any of it moved, in coordination with law enforcement (TRM).

    Re-read on the chain (2026-10-31 02:21 UTC): USDC contract lists the address as blocked (frozen) at check time

    Sources: TRM Labs analysis · Bitquery investigation · as of 2026-10-30 12:28 UTC

  9. Transfer
    Binance 14 0x28C6c0…1d60 Main receiver 0x5227f6…2f8c
    200M USDT + 13 other tokensUSDT and 13 other tokens
    Chain-checked Analyst / chain data
    Details and sources

    New deposits swept without another signature. Of the 200M USDT, Bitquery says Binance itself sent it to Binance 14 at 21:42 UTC and the operator moved it on 72 seconds later. TRM lists more sweeps at 20:59, 21:04, 22:39 and 23:56 UTC.

    Ethereum transaction 0x55ba4d…0556

    Re-read on the chain (2026-10-31 02:21 UTC): block 26301167 at 2026-10-29T21:44:11Z; status success; sender matches; recipient matches; time matches; USDT transferred 200,397,772

    Sources: Blockaid investigation · Bitquery investigation · TRM Labs analysis · Etherscan: transaction · as of 2026-10-30 12:28 UTC

  10. 22:10 UTC (TRM); the World Liberty post is dated 22:15 UTC
    Freeze
    World Liberty Financial 🔒→ Main receiver 0x5227f6…2f8c
    27.8M USD1 frozenUSD1
    Two reports Official source
    Details and sources

    World Liberty also froze USD1 in the compromised Binance hot wallet at 22:26 UTC (TRM).

    Sources: TRM Labs analysis · World Liberty post (X) · as of 2026-10-30 12:28 UTC

  11. Minute precision on the map
    Transfer
    Binance 14 0x28C6c0…1d60 Second receiver 0xa97bf7…8d10
    Tokens (amount not stated)Tokens
    Two reports Analyst / chain data
    Details and sources

    TRM lists a sweep at 22:39 UTC. The map shows the destination as the second receiver. Neither gives the transaction hash or the amount.

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  12. Revoke
    Binance 14 0x28C6c0…1d60 Sweeper contract 0x63e842…6fAe
    Delegation set to the zero addressEIP-7702
    Chain-checked Analyst / chain data
    Details and sources

    Binance cancelled the delegation 3 h 50 min after it was set. Withdrawals had been paused about 1.5 hours earlier (press reports).

    Ethereum transaction 0xafbf94…7209

    Re-read on the chain (2026-10-31 02:21 UTC): block 26301896 at 2026-10-30T00:10:35Z; status success; sender matches; recipient matches; time matches; tx type 0x4; 1 authorizations for nonces 18914904-18914904 all pointing to the stated contract

    Sources: Bitquery investigation · Blockaid investigation · Etherscan: transaction · as of 2026-10-30 12:28 UTC

  13. time not stated
    Transfer
    Tornado Cash (mixer) Operator wallet 0x7C8601…5CA0
    Three small withdrawals (gas money)ETH
    Two reports Analyst / chain data
    Details and sources

    From the morning of 28 Oct (TRM, Blockaid)

    The mixer hides the sender, so the withdrawals have no source address to read.

    Sources: Blockaid investigation · TRM Labs analysis · as of 2026-10-30 12:28 UTC

Addresses in this lane (8)
LabelChainAddressNote and source
Binance 14
victim		Ethereum0x28C6c06298d514Db089934071355E5743bf21d60Binance's busiest Ethereum hot wallet. It ran the attacker's code for 3 h 50 min.
Sources: Blockaid investigation · Bitquery investigation · TRM Labs analysis
Binance 16
victim		Ethereum0xDFd5293D8e347dFe59E90eFd55b2956a1343963dSecond Binance hot wallet drained at 20:24 UTC. Sent its ETH as an ordinary signed transfer.
Sources: Blockaid investigation · Bitquery investigation · TRM Labs analysis
Binance Hot Wallet 34
victim		Ethereum0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055Circle smart account owned by Binance 14. Where the USDC came from.
Sources: Blockaid investigation · Bitquery investigation
Operator wallet
operator		Ethereum0x7C8601d4645b93cea45F71e118A729332e6B5CA0Sent the delegation transaction and every sweep call. Blockaid labels it 'operator EOA (Tornado-funded)'.
Sources: Blockaid investigation · Bitquery investigation · Blockaid live fund-flow map
Main receiver
receiver		Ethereum0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8cCollection address with no earlier history. Holds the frozen USDT, USDC and gold tokens. The same address received funds on five other EVM chains.
holds 4.808 ETH at check time (2026-10-31 02:21 UTC)
Sources: Blockaid investigation · Bitquery investigation · TRM Labs analysis
Second receiver
receiver		Ethereum0xa97bf7836f8a08f9ed91d41453d371493fae8d10Second attacker receiver. Sold stolen tokens. Moved ETH into a stash at 06:36 UTC.
Sources: Bitquery investigation · Blockaid live fund-flow map
Sweeper contract
contract		Ethereum0x63e842B054Bd624a465454D533C33F573e9c6fAeUnverified contract. Names the operator as its only authorized caller. Binance 14 was made to run its code.
Sources: Blockaid investigation · Bitquery investigation · TRM Labs analysis
Tornado Cash (mixer)
service		EthereumMixer service; withdrawals go to many addressesThree small withdrawals funded the operator wallet from 28 Oct. Bitquery also reports about 1 ETH out of Tornado Cash at 14:54 UTC on 29 Oct for a gas wallet.
Sources: Blockaid investigation · TRM Labs analysis · Bitquery investigation

Ethereum: onward hops, swaps and stashes

24 actions18 chain-checked1 two reports2 one report3 unverified
ORIGIN+1 HOP+2 HOPS+3 HOPS+4 HOPS+5 HOPS ✓TRANSFER20,492 ETH 1TRANSFER3,237 ETH ✓TRANSFER3,000 ETH ✓TRANSFER17,260 ETH 1TRANSFER34,280 ETH ✓TRANSFER195,460 ETH ?TRANSFER88.5M RLUSD ✓TRANSFER500M USDT 2SWAP325M USDT→ETH ✓TRANSFER190M USDT ✓TRANSFER30M USDT ✓TRANSFER200M USDT ✓TRANSFER130M USDT ✓TRANSFER175M USDT ✓TRANSFER122,310 ETH ✓LEND60M USDT ✓TRANSFER175M USDT ?TRANSFER$149.6M ✓TRANSFER57,892 ETHMain receiver, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8cMain receiver0x5227f6…2f8c✓Second receiver, 0xa97bf7836f8a08f9ed91d41453d371493fae8d10Second receiver0xa97bf7…8d10Token seller, 0xe7024ab80143b1ef843efe6a58368696cb87958dToken seller0xe7024a…958dDownstream hops ×25Downstream hops ×2525 addressesUSDT hop (200M), 0x0ddf0480016e6bcb2c1f5d190d221fba1320697eUSDT hop (200M)0x0ddf04…697eUSDT hop (500M), 0x9749292d74fd460982d0912ea9515ea24736c762USDT hop (500M)0x974929…c762RLUSD wallet (not named)RLUSD walletserviceETH stash 1, 0x8532fa14acaf483729c449b8458aeddb900543d4ETH stash 10x8532fa…43d4✓ETH stash 5, 0x79e70d139fc05aa75f75611fdf2680e9952b544aETH stash 50x79e70d…544a✓ETH stash 6, 0x03b0ee5d82990cff1bda48651ac3e436d1a020eaETH stash 60x03b0ee…20ea✓ETH stash 7, 0x8d4b8ee62124b7ee140a51ddd07390a56f1c9e19ETH stash 70x8d4b8e…9e19✓ETH stash 8, 0xc2096a12ebe0944f4d39e59979f485afd92d850aETH stash 80xc2096a…850a✓ETH stash 4, 0x54401f80da97893a15d43566184635b6674bc942ETH stash 40x54401f…c942✓Aave borrower, 0x8d53903625b8e839b9df4bd28b0efb1cd6b8639aAave borrower0x8d5390…639aMarket makers (UniswapX, 1inch Fusion)Market makersserviceUSDT pass-through, 0x811f15855476156ebf86ba3b84fafb8ceaa4e84cUSDT pass-through0x811f15…e84cETH stash 2, 0xc887af690e0301cd4edbbce8f8d31b4ec65b286aETH stash 20xc887af…286a✓Aave USDT market (aEthUSDT), 0x23878914efe38d27c4d67ab83ed1b93a74d4086aAave USDT market0x238789…086aUSDT launder hops ×3Launder hops ×33 addressesFrozen wallet (175M USDT), 0xaa246bf639586a6ba46762d378ce50ca4fc654a0Frozen 175M USDT0xaa246b…54a0Frozen wallet (30M USDT), 0xb171ca86f82070282138352ff7111b494060c8c3Frozen 30M USDT0xb171ca…c8c3ETH stash 3, 0x897c80d1a9729e94460e2bd93178bd5215158df3ETH stash 30x897c80…8df3✓FROZEN · Ripple40.5M RLUSDFROZEN · Tether175M USDTFROZEN · Tether30M USDTFROZEN · TetherblockedFROZEN · Tetherblocked
Actions in time order (24)
  1. Transfer
    Main receiver 0x5227f6…2f8c USDT hop (500M) 0x974929…c762
    500M USDTUSDT
    Chain-checked Analyst / chain data
    Details and sources

    The first launder hop. Tether froze the receiver 37 minutes after the big sweep (Bitquery).

    Ethereum transaction 0x68d7d6…659a

    Re-read on the chain (2026-10-31 02:21 UTC): 1 USDT transfer totalling 500,000,000 at 2026-10-29T20:30:11Z, block 26300799

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  2. Transfer
    Main receiver 0x5227f6…2f8c USDT hop (200M) 0x0ddf04…697e
    200M USDTUSDT
    Chain-checked Analyst / chain data
    Details and sources

    Ethereum transaction 0x1fc0ef…c81c

    Re-read on the chain (2026-10-31 02:21 UTC): 1 USDT transfer totalling 200,000,000 at 2026-10-29T20:33:23Z, block 26300815

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  3. Minute precision on the map
    Transfer
    Main receiver 0x5227f6…2f8c ETH stash 1 0x8532fa…43d4
    195,460 ETHETH
    Chain-checked Analyst / chain data
    Details and sources

    Bitquery and the map give 197,460 ETH, which is what the stash holds in total. The transfer found on the chain is 195,460 ETH; the other 2,000 ETH arrived by other transfers.

    Ethereum transaction 0x551d79…2c76

    Re-read on the chain (2026-10-31 02:21 UTC): 1 transaction totalling 195,460 ETH from 2026-10-29T20:38:47Z, first in block 26300842

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  4. Transfer
    USDT hop (200M) 0x0ddf04…697e Aave borrower 0x8d5390…639a
    190M USDTUSDT
    Chain-checked Analyst / chain data
    Details and sources

    Ethereum transaction 0xc0fab3…5183

    Re-read on the chain (2026-10-31 02:21 UTC): 1 USDT transfer totalling 190,000,000 at 2026-10-29T20:52:59Z, block 26300911

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  5. Lend
    Aave borrower 0x8d5390…639a Aave USDT market (aEthUSDT) 0x238789…086a
    60M USDT supplied in two transfers (10M, then 50M)USDT
    Chain-checked Analyst / chain data
    Details and sources

    TRM adds that about 19,760 ETH was borrowed against it. The borrow is not read here.

    Ethereum transaction 0x420e74…14eb

    Re-read on the chain (2026-10-31 02:21 UTC): 2 USDT transfers totalling 60,000,000 at 2026-10-29T20:57:59Z, block 26300936

    Sources: TRM Labs analysis · Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  6. Transfer
    USDT hop (500M) 0x974929…c762 USDT pass-through 0x811f15…e84c
    175M USDTUSDT
    Chain-checked Analyst / chain data
    Details and sources

    Ethereum transaction 0x1fb992…670b

    Re-read on the chain (2026-10-31 02:21 UTC): 1 USDT transfer totalling 175,000,000 at 2026-10-29T20:59:11Z, block 26300942

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  7. Transfer
    Aave borrower 0x8d5390…639a USDT launder hops ×3
    130M USDTUSDT
    Chain-checked Analyst / chain data
    Details and sources

    The recipient is the first of the three hop addresses that the map groups.

    Ethereum transaction 0xd2e7e5…c3d8

    Re-read on the chain (2026-10-31 02:21 UTC): 1 USDT transfer totalling 130,000,000 at 2026-10-29T21:01:59Z, block 26300956

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  8. Transfer
    USDT pass-through 0x811f15…e84c Frozen wallet (175M USDT) 0xaa246b…54a0
    175M USDTUSDT
    Chain-checked Analyst / chain data
    Details and sources

    TRM: the remaining 175M USDT of the 500M batch was frozen.

    Ethereum transaction 0xb6d7d3…266f

    Re-read on the chain (2026-10-31 02:21 UTC): 1 USDT transfer totalling 175,000,000 at 2026-10-29T21:08:23Z, block 26300988

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  9. Transfer
    USDT launder hops ×3 Frozen wallet (30M USDT) 0xb171ca…c8c3
    30M USDTUSDT
    Chain-checked Analyst / chain data
    Details and sources

    TRM: a chain of hop wallets swapped 200M USDT on Uniswap and 30M was frozen.

    Ethereum transaction 0x1e6f85…e7a7

    Re-read on the chain (2026-10-31 02:21 UTC): 1 USDT transfer totalling 30,000,000 at 2026-10-29T21:16:11Z, block 26301027

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  10. First of many transfers; minute precision on the map
    Transfer
    Main receiver 0x5227f6…2f8c Downstream hops ×25
    $149.6M (at the map's prices)Mixed assets
    Unverified Analyst / chain data
    Details and sources

    The map groups 25 downstream addresses. It does not give the assets or one transaction. The $4.7M still held by 14 of them is listed on the map.

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  11. Minute precision on the map
    Transfer
    Frozen wallet (30M USDT) 0xb171ca…c8c3 ETH stash 3 0x897c80…8df3
    57,892 ETHETH
    Chain-checked Analyst / chain data
    Details and sources

    The map and Bitquery give 78,415 ETH, which is what the stash holds in total. The transfer on the chain is 57,892 ETH.

    Ethereum transaction 0x2552fe…1fb1

    Re-read on the chain (2026-10-31 02:21 UTC): 1 transaction totalling 57,892 ETH from 2026-10-29T21:35:59Z, first in block 26301126

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  12. Minute precision on the map
    Transfer
    USDT hop (500M) 0x974929…c762 ETH stash 2 0xc887af…286a
    122,310 ETHETH
    Chain-checked Analyst / chain data
    Details and sources

    The map and Bitquery give 137,602 ETH, which is what the stash holds in total. The transfer on the chain is 122,310 ETH, which matches the about 122,300 ETH that TRM says the 325M USDT sale produced.

    Ethereum transaction 0xbd7822…fa66

    Re-read on the chain (2026-10-31 02:21 UTC): 1 transaction totalling 122,310 ETH from 2026-10-29T21:47:47Z, first in block 26301185

    Sources: Blockaid live fund-flow map · Bitquery investigation · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  13. 22:01 UTC (TRM)
    Freeze
    Ripple (RLUSD issuer) 🔒→ RLUSD wallet (not named)
    40.5M RLUSD frozenRLUSD
    Unverified Analyst / chain data
    Details and sources

    TRM says it confirmed this freeze on-chain but does not publish the wallet address. Binance co-CEO Yi He said Ripple helped stop about $200M from moving.

    Sources: TRM Labs analysis · as of 2026-10-30 12:28 UTC

  14. Minute precision on the map
    Transfer
    Token seller 0xe7024a…958d ETH stash 4 0x54401f…c942
    20,492 ETHETH
    Chain-checked Analyst / chain data
    Details and sources

    The map and Bitquery give 40,601 ETH, which is what the stash holds in total. The transfer on the chain is 20,492 ETH. Bitquery says four token-selling wallets sent 14,540 ETH into one stash between 05:27 and 05:36 UTC on 30 Oct.

    Ethereum transaction 0x5c7117…eeaa

    Re-read on the chain (2026-10-31 02:21 UTC): 1 transaction totalling 20,492 ETH from 2026-10-29T22:08:59Z, first in block 26301291

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  15. Minute precision on the map
    Transfer
    Main receiver 0x5227f6…2f8c ETH stash 5 0x79e70d…544a
    34,280 ETHETH
    One report Analyst / chain data
    Details and sources

    No single transfer from the main receiver to this stash was found within 15 minutes of the stated time. The stash balance is chain-checked on the node, so the ETH is there; how it got there is the map's account only.

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  16. Minute precision on the map
    Transfer
    Main receiver 0x5227f6…2f8c ETH stash 7 0x8d4b8e…9e19
    3,237 ETHETH
    One report Analyst / chain data
    Details and sources

    No single transfer from the main receiver to this stash was found within 15 minutes of the stated time. The stash balance is chain-checked on the node.

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  17. Minute precision on the map
    Transfer
    Second receiver 0xa97bf7…8d10 ETH stash 8 0xc2096a…850a
    3,000 ETHETH
    Chain-checked Analyst / chain data
    Details and sources

    Ethereum transaction 0x04989d…b14e

    Re-read on the chain (2026-10-31 02:21 UTC): 1 transaction totalling 3,000 ETH from 2026-10-30T01:17:47Z, first in block 26302230

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  18. Transfer
    Main receiver 0x5227f6…2f8c ETH stash 6 0x03b0ee…20ea
    17,260 ETHETH
    Chain-checked Analyst / chain data
    Details and sources

    New wallet at 05:15 UTC. The attacker was pulling its ETH together.

    Ethereum transaction 0x9edf86…6071

    Re-read on the chain (2026-10-31 02:21 UTC): block 26303416 at 2026-10-30T05:15:47Z; status success; sender matches; recipient matches; time matches; value 17,260 ETH

    Sources: Bitquery investigation · Blockaid live fund-flow map · Etherscan: transaction · as of 2026-10-30 12:28 UTC

  19. time not stated
    Freeze
    Tether (issuer) 🔒→ Frozen wallet (175M USDT) 0xaa246b…54a0
    175M USDT frozenUSDT
    Chain-checked Analyst / chain data
    Details and sources

    Time not stated

    TRM: Tether froze 205M USDT in two other Ethereum wallets. 175M plus 30M matches that sum.

    Re-read on the chain (2026-10-31 02:21 UTC): USDT contract lists the address as blocked (frozen) at check time

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  20. time not stated
    Freeze
    Tether (issuer) 🔒→ Frozen wallet (30M USDT) 0xb171ca…c8c3
    30M USDT frozenUSDT
    Chain-checked Analyst / chain data
    Details and sources

    Time not stated

    Re-read on the chain (2026-10-31 02:21 UTC): USDT contract lists the address as blocked (frozen) at check time

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  21. time not stated
    Freeze
    Tether (issuer) 🔒→ USDT hop (200M) 0x0ddf04…697e
    Address blocked (amount at freeze not stated)USDT
    Chain-checked Analyst / chain data
    Details and sources

    Time not stated

    Re-read on the chain (2026-10-31 02:21 UTC): USDT contract lists the address as blocked (frozen) at check time

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  22. time not stated
    Freeze
    Tether (issuer) 🔒→ USDT hop (500M) 0x974929…c762
    Address blocked (amount at freeze not stated)USDT
    Chain-checked Analyst / chain data
    Details and sources

    Time not stated

    Bitquery: six of Tether's 11 freezes hit wallets that were already empty.

    Re-read on the chain (2026-10-31 02:21 UTC): USDT contract lists the address as blocked (frozen) at check time

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  23. time not stated
    Swap
    USDT hop (500M) 0x974929…c762 Market makers (UniswapX, 1inch Fusion)
    About 325M USDT sold for about 122,300 ETHUSDT to ETH
    Two reports Analyst / chain data
    Details and sources

    Within the first hours

    Price near $2,650 per ETH when ETH traded near $2,300 to $2,350, a discount above 10% (TRM). Bitquery puts the whole swap volume at $729M of USDT through UniswapX, 1inch Fusion and Uniswap pools, about 16% over the market price. The market-maker addresses are not published.

    Sources: TRM Labs analysis · Bitquery investigation · as of 2026-10-30 12:28 UTC

  24. time not stated
    Transfer
    Main receiver 0x5227f6…2f8c RLUSD wallet (not named)
    88.5M RLUSD through two hopsRLUSD
    Unverified Analyst / chain data
    Details and sources

    Time not stated in the sources

    TRM gives no addresses for the two hops. It says 48M RLUSD was sold on decentralized exchanges between 21:42 and 22:01 UTC.

    Sources: TRM Labs analysis · as of 2026-10-30 12:28 UTC

Addresses in this lane (20)
LabelChainAddressNote and source
Aave USDT market (aEthUSDT)
service		Ethereum0x23878914efe38d27c4d67ab83ed1b93a74d4086aThe contract named Aave Ethereum USDT (symbol aEthUSDT, read from the contract). It received the USDT that the borrower supplied. Aave froze the affected markets after the borrow (TRM).
Sources: TRM Labs analysis
Downstream hops ×25
hop		Ethereum
25 addresses
  • 0xe4f9070e1316de2988fc6f869fead8fb99cc74cd
  • 0x0084847bb9384d2fc5e8836e663689467e3e4c81
  • 0x06ea1ab3ecf570029eb1f94dbb9eac06bc79685f
  • 0x1291be4c90239d14527ba880ad2b6e5cb82116b1
  • 0x5c23023ca6633f91ded909b4a753a3ca00fea4fc
  • 0x8c7111e9a3270457b76f0bd137209089047a6aa4
  • 0xa3b3dee870f01560fdbe5af659c9c9135748886f
  • 0xb3ddec0ccc5c3ba733fcdf5a15f98c95ec5a5fdb
  • 0xb58bf76d209fa71f60013ce1933ca331177a4f08
  • 0xdd6dbbe67262ccc9b1824de1257999efc6c52296
  • 0xf1eadb247ffc7d7d6600e84daaf9ee85737e73c4
  • 0x008f06f04b72da2621a4f37f5531cc7352187dcd
  • 0x470b3f37e4afabbb0cbf02024b171da89fa5f0a4
  • 0x62b16e7eb76be5adbe544659cf246ff870ffc82e
  • 0x1192093ad796156e29025af779542d6de62d7a16
  • 0x13723799ec02d2ab3933be11c7eb7c9904eac7c1
  • 0x4bd7a51d216e7d406811b11ffc8e1caad452b29f
  • 0x56c3b3224973dc7240877e630f37a160a5332714
  • 0x6abec14ec8dba805c3bc2e9133214a3c7688cc3f
  • 0xb196981c37cfe105506613d1bd4153b9e63df92e
  • 0xb77d96c8676abdb1b2eec3a5a41a028e8e722c61
  • 0xd51fca94212e644b4a01f4a5bcf64ac61b5579b4
  • 0x3fecfdf6ba478287ff9246ddb9c3028c9f1f7624
  • 0x415e50c7cc3f5a77b2ec13494507b425d44a8f60
  • 0xf86bd1865945b1d86dedb03ce40d2d9b3a14358f
Swap relays, consolidation hubs and gas wallets downstream of the collectors.
Sources: Blockaid live fund-flow map
Frozen wallet (175M USDT)
frozen		Ethereum0xaa246bf639586a6ba46762d378ce50ca4fc654a0Tether froze it (map). TRM counts 205M USDT frozen in two other Ethereum wallets.
Sources: Blockaid live fund-flow map · TRM Labs analysis
Frozen wallet (30M USDT)
frozen		Ethereum0xb171ca86f82070282138352ff7111b494060c8c3Tether froze it (map).
Sources: Blockaid live fund-flow map · TRM Labs analysis
Market makers (UniswapX, 1inch Fusion)
service		EthereumIntent-based swap venues; fillers are many addressesBought stolen USDT at a discount of more than 10% (TRM) and about 16% (Bitquery).
Sources: TRM Labs analysis · Bitquery investigation
USDT hop (200M)
hop		Ethereum0x0ddf0480016e6bcb2c1f5d190d221fba1320697eFrozen.
Sources: Blockaid live fund-flow map
USDT hop (500M)
hop		Ethereum0x9749292d74fd460982d0912ea9515ea24736c762First launder hop. Frozen.
Sources: Blockaid live fund-flow map
Aave borrower
hop		Ethereum0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a60M USDT supplied to Aave and ETH borrowed against it. Frozen.
Sources: Blockaid live fund-flow map · TRM Labs analysis
USDT launder hops ×3
hop		Ethereum
3 addresses
  • 0x77edef23fbd05921c26fe29fcc3a65e14d2ac3eb
  • 0x7aa4d3029e4c6a8e916300014ad95b6d6c03bfd1
  • 0xccbef95633adb5cd2b5038db5a38d77e726ca263
EIP-7702 hops that swapped USDT out.
Sources: Blockaid live fund-flow map
USDT pass-through
hop		Ethereum0x811f15855476156ebf86ba3b84fafb8ceaa4e84cFunds passed through.
Sources: Blockaid live fund-flow map
RLUSD wallet (not named)
hop		EthereumTRM does not publish the address88.5M RLUSD passed through two hops. The last wallet sold 48M and kept 40.5M, which Ripple froze.
Sources: TRM Labs analysis
ETH stash 1
stash		Ethereum0x8532fa14acaf483729c449b8458aeddb900543d4Holds ETH. Not sent to any exchange, mixer or bridge as of 06:43 UTC on 30 Oct (Bitquery).
holds 197,460 ETH at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · Blockaid live fund-flow map
ETH stash 2
stash		Ethereum0xc887af690e0301cd4edbbce8f8d31b4ec65b286aHolds ETH. Not sent to any exchange, mixer or bridge as of 06:43 UTC on 30 Oct (Bitquery).
holds 137,602 ETH at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · Blockaid live fund-flow map
ETH stash 3
stash		Ethereum0x897c80d1a9729e94460e2bd93178bd5215158df3Holds ETH. Not sent to any exchange, mixer or bridge as of 06:43 UTC on 30 Oct (Bitquery).
holds 78,415 ETH at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · Blockaid live fund-flow map
ETH stash 4
stash		Ethereum0x54401f80da97893a15d43566184635b6674bc942Holds ETH. Not sent to any exchange, mixer or bridge as of 06:43 UTC on 30 Oct (Bitquery).
holds 40,601 ETH at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · Blockaid live fund-flow map
ETH stash 5
stash		Ethereum0x79e70d139fc05aa75f75611fdf2680e9952b544aHolds ETH. Not sent to any exchange, mixer or bridge as of 06:43 UTC on 30 Oct (Bitquery).
holds 34,280 ETH at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · Blockaid live fund-flow map
ETH stash 6
stash		Ethereum0x03b0ee5d82990cff1bda48651ac3e436d1a020eaHolds ETH. Not sent to any exchange, mixer or bridge as of 06:43 UTC on 30 Oct (Bitquery).
holds 17,260 ETH at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · Blockaid live fund-flow map
ETH stash 7
stash		Ethereum0x8d4b8ee62124b7ee140a51ddd07390a56f1c9e19Holds ETH. Not sent to any exchange, mixer or bridge as of 06:43 UTC on 30 Oct (Bitquery).
holds 3,237 ETH at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · Blockaid live fund-flow map
ETH stash 8
stash		Ethereum0xc2096a12ebe0944f4d39e59979f485afd92d850aHolds ETH. Not sent to any exchange, mixer or bridge as of 06:43 UTC on 30 Oct (Bitquery).
holds 3,000 ETH at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · Blockaid live fund-flow map
Token seller
hop		Ethereum0xe7024ab80143b1ef843efe6a58368696cb87958dSold stolen tokens for ETH, then moved the ETH to a stash.
Sources: Blockaid live fund-flow map · Bitquery investigation

Bitcoin

3 actions2 chain-checked1 two reports

Bitcoin: 18,270 BTC, about $1.47B, in one block, then split by a peel chain. TRM Labs analysis · Bitquery investigation

ORIGIN+1 HOP+2 HOPS+3 HOPS ✓TRANSFER18,270 BTC 2TRANSFERpeel chain ✓TRANSFER19 addressesBinance Bitcoin hot wallet, bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3hBinance BTC hotbc1qm34l…7s3hFirst Bitcoin receiver, bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnmFirst Bitcoin rece…bc1q0mtc…2mnm✓Peel-chain intermediates ×10Peel chain ×1010 addresses19 addresses holding the BTC19 BTC addresses19 addresses✓
Actions in time order (3)
  1. Transfer
    Binance Bitcoin hot wallet bc1qm34l…7s3h First Bitcoin receiver bc1q0mtc…2mnm
    18,270.2 BTCBTC
    Chain-checked Analyst / chain data
    Details and sources

    All in one block (973,732), through 12 outputs to the first receiver. The transfers paid about twice the usual fee (Bitquery).

    Re-read on the chain (2026-10-31 02:21 UTC): received 18,270 BTC in total, first transaction at 2026-10-29T20:20:06Z, 0 BTC unspent at check time

    Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  2. Transfer
    First Bitcoin receiver bc1q0mtc…2mnm Peel-chain intermediates ×10
    Peel chain inside the same blockBTC
    Two reports Analyst / chain data
    Details and sources

    Change outputs spent into the next peel (TRM, map). The addresses are listed on the map.

    Sources: TRM Labs analysis · Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  3. Bitquery: unspent since 20:48 UTC
    Transfer
    Peel-chain intermediates ×10 19 addresses holding the BTC
    18,270.2 BTC in 19 addressesBTC
    Chain-checked Analyst / chain data
    Details and sources

    17 lots of 1,000 BTC, one of 832.5 and one of 437.7 (Bitquery).

    Re-read on the chain (2026-10-31 02:21 UTC): 19 addresses hold 18,270 BTC at check time; 19 of them have never spent

    Sources: Bitquery investigation · Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

Addresses in this lane (4)
LabelChainAddressNote and source
19 addresses holding the BTC
holding		Bitcoin
19 addresses
  • bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s
  • bc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lag
  • bc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gw
  • bc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3s
  • bc1qz8hdwv8gmml0u96dsvnzsagz6krjyzxmgxupdp
  • bc1q42flhayrzy3zh8lkyevw8qcjduurt9a35wlsyx
  • bc1q63qrfrpsg5hh0zzn3kp2xx9vljl7dq7tatsjxp
  • bc1q0ts8gaf9ht0rr4u02hr56f8thndqsc4kmkmfv3
  • bc1q2wvz0kcsn4hqmajwtey30ud27fl25w8pveznn6
  • bc1qalwnl7dtaa73fsq5tyn0ghfy3fgfpqkt69tca8
  • bc1qjwdw6vrzq4vf6hckutvx4ucj86awwv99mxnz7w
  • bc1qs3aej5tmcdz0vctz8y9rjcxtxg8v5385577s56
  • bc1qm2j6v3247khlwzxl7p9vqnfkghcllyhv9wjaat
  • bc1qs6xnmhar38z44g2za93pv8ygdcwurrh8l87w3v
  • bc1qf5cyvv9w50tx9xx9s3xwsne0z87wvjj9l8a35u
  • bc1qg3nrzpuvq2pxqx74tcrywr09dc208ze96n3t53
  • bc1qm8v88m5fy6kuq9myva2eemwycxqd3e0zcrs2l8
  • bc1qrg025e2pgx0rwya2kpgtj30972p64jt0hn6zyt
  • bc1qxg0l4p6xc50zuv9cl5f0l0wmaxjpg8wcy7s9ra
Most hold exactly 1,000 BTC. Unspent since 20:48 UTC. Blockaid counts 16 lots of 1,000 BTC; Bitquery lists 17.
19 addresses hold 18,270 BTC at check time; 19 of them have never spent (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · Blockaid live fund-flow map
Binance Bitcoin hot wallet
victim		Bitcoinbc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3hSent 18,270 BTC in one block.
Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map
Peel-chain intermediates ×10
hop		Bitcoin
10 addresses
  • bc1qdyy9q2lrnn5qh3ju996pgt95eesvc38lppdewn
  • bc1qn43ejagzgxgle394ynmv5sv3f9ydc48qme7t02
  • bc1qvws6kh5vjf7apg7f82wd5av8w2gmfj2zxkm8jc
  • bc1qsmvvvvya6ak2gmsjcxc06ns7yrsx7q4x492vf2
  • bc1qt8mrl9uchasf7pqhwlz6ezm9g44x7xj0vs6zqz
  • bc1q96qkjsye5qruf9yksqdqg09lzdmur7wau2ga6u
  • bc1qhuq4genel5cuj00p7ggn30dwnzzjsw8mz3z2je
  • bc1qrsrh56k4rpal88w0xpjuul0m78ud62akcwue5e
  • bc1qk8kpt0suefus8zz3fp78w8993frc5x97w423wl
  • bc1q66l8z9htj4cd7pf8nnlc6mrxyssudm6hyg7a2a
Change outputs inside the peel chain, all spent into the next peel in the same block.
Sources: Blockaid live fund-flow map
First Bitcoin receiver
receiver		Bitcoinbc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnmSplit the coins into round 1,000 and 100 BTC pieces inside the same block (peel chain).
received 18,270 BTC in total, first transaction at 2026-10-29T20:20:06Z, 0 BTC unspent at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map

TRON

15 actions5 chain-checked6 two reports3 one report1 unverified

TRON: 612.7M USDT and 46.4M TRX, about $628M. TRM Labs analysis · Bitquery investigation

ORIGIN+1 HOP+2 HOPS+3 HOPS+4 HOPS+5 HOPS 1TRANSFER$19M 2TRANSFERTRX lots ✓TRANSFER66M USDT 2TRANSFER638.2M TRX 2SWAPto 638.2M TRX 2TRANSFER46.4M TRX 1TRANSFER$1.5M ✓TRANSFER612.7M USDT ✓TRANSFER46.4M TRX ✓TRANSFER300M USDT ✓LENDjUSDT receipt ?CROSS-CHAIN$7.1M 1TRANSFER5 walletsBinance TRON hot wallet, TDqSquXBgUCLYvYC4XZgrprLK589dkhSCfBinance TRON hotTDqSquXB…hSCfFirst TRON receiver, TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGiFirst TRON receiverTG5iBMQP…zsGiTRON swap hop, TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4TRON swap hopTPBkSjkC…bKN4TRX disperser, TRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRkiTRX disperserTRBdWqHn…PRkiJustLend (lending market)JustLendserviceSunSwap (DEX)SunSwap (DEX)serviceFrozen wallet (66M USDT), TCzBTkqn66yApqbYoPezaEQosM5DAd7Y62Frozen 66M USDTTCzBTkqn…7Y62TRX relays ×5TRX relays ×55 addressesTRX holder (638.2M TRX), TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8ATRX holderTSpe5HC3…yZ8ATRON layering wallets ×351Layering ×351351 addressesTRX split wallets ×5TRX split ×55 addressesCross-chain bridgesCross-chain bridgesserviceWallets still holding ×10Holding ×1010 addressesFROZEN · Tether66M USDTFROZEN · Tether312.7M USDT
Actions in time order (15)
  1. Transfer
    Binance TRON hot wallet TDqSquXB…hSCf First TRON receiver TG5iBMQP…zsGi
    46,384,098 TRXTRX
    Chain-checked Analyst / chain data
    Details and sources

    TRON transaction 72f5fbed…ab9c

    Re-read on the chain (2026-10-31 02:21 UTC): 46,384,098 TRX from TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf to TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi at 2026-10-29T20:21:00Z

    Sources: TRM Labs analysis · Blockaid live fund-flow map · Tronscan: transaction · as of 2026-10-30 12:28 UTC

  2. Transfer
    Binance TRON hot wallet TDqSquXB…hSCf First TRON receiver TG5iBMQP…zsGi
    612,729,468 USDTUSDT
    Chain-checked Analyst / chain data
    Details and sources

    Built with settings not seen on Binance's own transfers that night (Bitquery). Map time 20:21 UTC; the chain shows 20:22:45.

    TRON transaction 4203af9c…253e

    Re-read on the chain (2026-10-31 02:21 UTC): 1 USDT transfer totalling 612,729,468, at 2026-10-29T20:22:45Z

    Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map · Tronscan: transaction · as of 2026-10-30 12:28 UTC

  3. Transfer
    First TRON receiver TG5iBMQP…zsGi TRON swap hop TPBkSjkC…bKN4
    300M USDT in two transfersUSDT
    Chain-checked Analyst / chain data
    Details and sources

    612.7M minus 300M leaves the 312.7M USDT that Bitquery reports frozen in the first receiver.

    TRON transaction fd8061aa…6222

    Re-read on the chain (2026-10-31 02:21 UTC): 2 USDT transfers totalling 300,000,000, from 2026-10-29T20:45:51Z to 2026-10-29T20:56:09Z

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  4. Minute precision on the map
    Swap
    TRON swap hop TPBkSjkC…bKN4 SunSwap (DEX)
    USDT swapped for 638.2M TRXUSDT to TRX
    Two reports Analyst / chain data
    Details and sources

    Bitquery: on TRON the stolen USDT was swapped on SunSwap.

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  5. Minute precision on the map
    Transfer
    SunSwap (DEX) TRX holder (638.2M TRX) TSpe5HC3…yZ8A
    638.2M TRXTRX
    Two reports Analyst / chain data
    Details and sources

    The TRX holder then moved the TRX out in five transfers from 10:15 UTC on 30 Oct (map).

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  6. Lend
    TRON swap hop TPBkSjkC…bKN4 JustLend (lending market)
    USDT supplied to JustLend (receipt: 918,238.7 jUSDT)USDT
    Chain-checked Analyst / chain data
    Details and sources

    TRM says 300M USDT moved to a wallet that supplied it to JustLend. The chain shows this wallet received the JustLend receipt token jUSDT at 21:14:57; the USDT amount supplied is not read here. The map also shows 638.2M TRX swapped from the same hop, so part of the 300M went to each.

    TRON transaction 7bfbd96e…517a

    Re-read on the chain (2026-10-31 02:21 UTC): 1 jUSDT transfer totalling 918,239, at 2026-10-29T21:14:57Z

    Sources: TRM Labs analysis · Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  7. Transfer
    TRON swap hop TPBkSjkC…bKN4 Frozen wallet (66M USDT) TCzBTkqn…7Y62
    66M USDTUSDT
    Chain-checked Analyst / chain data
    Details and sources

    TRON transaction 55c2524b…fa5c

    Re-read on the chain (2026-10-31 02:21 UTC): 1 USDT transfer totalling 65,990,000, at 2026-10-29T21:16:18Z

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  8. Minute precision on the map
    Transfer
    First TRON receiver TG5iBMQP…zsGi TRX disperser TRBdWqHn…PRki
    46.4M TRXTRX
    Two reports Analyst / chain data
    Details and sources

    Bitquery: since 02:45 UTC this wallet sent out 11.4M TRX in more than 30 lots.

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  9. Minute precision on the map
    Transfer
    TRX disperser TRBdWqHn…PRki TRX relays ×5
    TRX in many lotsTRX
    Two reports Analyst / chain data
    Details and sources

    Sources: Bitquery investigation · Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  10. Minute precision on the map
    Transfer
    TRX relays ×5 TRON layering wallets ×351
    $8.4M in from the relays, $10.9M from the disperserTRX, USDT
    One report Analyst / chain data
    Details and sources

    The map shows 351 layering wallets. Bitquery followed two chains of this kind: the TRX is swapped back to USDT on SunSwap and sent to two older wallets it could not identify.

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  11. First transfers 04:41 UTC, minute precision (map)
    Cross-chain
    TRON layering wallets ×351 Cross-chain bridges
    $7.1M to 123 Ethereum addressesTRX, USDT to ETH
    Unverified Analyst / chain data
    Details and sources

    Only the Blockaid map reports this. Bitquery reports no bridge use from the wallets it followed up to 06:43 UTC. The destinations are listed on the map.

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  12. Minute precision on the map
    Transfer
    TRON layering wallets ×351 Wallets still holding ×10
    $1.5M still heldTRX, USDT
    One report Analyst / chain data
    Details and sources

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  13. Five transfers between 10:15 and 10:20 UTC on 30 Oct (map)
    Transfer
    TRX holder (638.2M TRX) TSpe5HC3…yZ8A TRX split wallets ×5
    $173.3M held after the splitTRX
    One report Analyst / chain data
    Details and sources

    After the newest Bitquery reading (06:43 UTC).

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  14. time not stated
    Freeze
    Tether (issuer) 🔒→ Frozen wallet (66M USDT) TCzBTkqn…7Y62
    66M USDT frozenUSDT
    Two reports Analyst / chain data
    Details and sources

    Time not stated

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  15. time not stated
    Freeze
    Tether (issuer) 🔒→ First TRON receiver TG5iBMQP…zsGi
    312.7M USDT frozenUSDT
    Two reports Analyst / chain data
    Details and sources

    Time not stated

    TRM: 378.7M USDT frozen in two TRON wallets. 312.7M here plus 66M below matches.

    Sources: Bitquery investigation · TRM Labs analysis · as of 2026-10-30 12:28 UTC

Addresses in this lane (13)
LabelChainAddressNote and source
Cross-chain bridges
service		TRONTHORChain, Symbiosis, Across and USDT0 (LayerZero) contractsThe map shows 123 Ethereum addresses that received TRON funds this way. Bitquery, reading at 06:43 UTC, found no transfer to a bridge from the wallets it followed.
Sources: Blockaid live fund-flow map · Bitquery investigation
JustLend (lending market)
service		TRONProtocol contracts
Sources: TRM Labs analysis
TRON layering wallets ×351
hop		TRON
351 addresses (first 3 shown)
  • TA9i3JCnLQMuCUT5u1NUcGpKyQpGXgFJhD
  • TANbYCFd7zewb7PCdpY4jPbSbDV1tCkLdE
  • TAdauq6vLgqXD3771KoWHdN2M9e7jUfWzV
TRX peeled into fresh wallets, swapped and forwarded. Most are now empty.
Sources: Blockaid live fund-flow map
TRX relays ×5
hop		TRON
5 addresses
  • TUoVsNvkSbCQFty1tLViCgvMjNRGGEK6eM
  • TYZ8AP4caGYmccXwexziAgr2x5CsGTxFws
  • TDNF7CwfcKvgtaRPrMg4isijtf73kr8uRA
  • TXsZPPBhnnjdJcVASFTu633NXuhs3AXE9V
  • TYZ98phfoPWmiQhfHrYHvLW6jgnRXGuKpw

Sources: Blockaid live fund-flow map
SunSwap (DEX)
service		TRONProtocol contracts
Sources: Bitquery investigation
Frozen wallet (66M USDT)
frozen		TRONTCzBTkqn66yApqbYoPezaEQosM5DAd7Y62Tether froze it. With the first TRON receiver, 378.7M USDT frozen on TRON (TRM).
Sources: Blockaid live fund-flow map · TRM Labs analysis
First TRON receiver
receiver		TRONTG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGiReceived the USDT. 312.7M USDT frozen here (Bitquery).
Sources: Bitquery investigation · Blockaid live fund-flow map
TRON swap hop
hop		TRONTPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4Received 300M USDT. Swapped most of it for TRX on SunSwap.
Sources: Blockaid live fund-flow map · Bitquery investigation
TRX disperser
hop		TRONTRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRkiSent TRX out in more than 30 lots from 02:45 UTC (Bitquery).
Sources: Bitquery investigation · Blockaid live fund-flow map
Wallets still holding ×10
holding		TRON
10 addresses
  • TC2tzn3i3jWY6rd3zparGTrzcSGPSZYWXa
  • TJRbgAWaRUG2hb83nQsuVUC1RP1Y18dHfK
  • TRkAp7BVoksDWGZUKHW5SQr7mKoQ9beH1n
  • TF4xMd2WbqP18T9AgcPLard4RyKQSQW7Yo
  • TJgezeSabRvhNfvxxgHCniWNnnw8JAHPWV
  • TWxN4QCeNHHV2bWwYLUnGU27Pnw9SLN13T
  • TEz8jzee75rs3ji5V62HfoDTmsCGEdP1Zx
  • TLEgEFRFcFBmKiAEccLCAQUX8csT2TNC3L
  • TNWyDsFm3PY41YZnFug6xLTXsC545Z7wh9
  • TU33oFPnuN7ww9VWtDhoMWC5JcQEqyq2GD
Still holding about $1.5M in TRX or USDT.
Sources: Blockaid live fund-flow map
Binance TRON hot wallet
victim		TRONTDqSquXBgUCLYvYC4XZgrprLK589dkhSCfSent 612.7M USDT and 46.4M TRX.
Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map
TRX split wallets ×5
stash		TRON
5 addresses
  • TAk1xJNWuBYvJHLsUiBFLeuK6xvpQUFYP5
  • TCBAz7itvtX5CjBzVMPQdrbwQLN63ao1fk
  • TJajtPqDqUGh1Sr1j8ugHoSXBVpaFLLHKT
  • TKkH2vH6kyi2QKcMbqym53WMuvdd1xvw6K
  • TL2F4GhnaFVZBZPncHYjwfYZFW44NcfVwj
Four still hold the TRX they received from the TRX holder.
Sources: Blockaid live fund-flow map
TRX holder (638.2M TRX)
stash		TRONTSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8AReceived 638.2M TRX from the swap hop. Moved it out in five transfers from 10:15 UTC on 30 Oct (map).
Sources: Bitquery investigation · Blockaid live fund-flow map

XRP Ledger

1 actions1 chain-checked

XRP Ledger: 233.46M XRP, about $296M, from five Binance accounts. The first theft of the night. TRM Labs analysis · Bitquery investigation

ORIGIN+1 HOP ✓TRANSFER233.46M XRPBinance XRP accounts ×5Binance XRP ×55 addressesXRP receiver, rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMxXRP receiverrK21t6nG…fzMx✓
Actions in time order (1)
  1. Five payments between 20:05 and 20:09 UTC; the first is linked
    Transfer
    Binance XRP accounts ×5 XRP receiver rK21t6nG…fzMx
    233.46M XRP in five paymentsXRP
    Chain-checked Analyst / chain data
    Details and sources

    The first theft of the night. The XRP account shares no address with the rest of the attack. It is tied to it by timing and by how the transfers were built (Bitquery).

    XRP Ledger transaction 78E31E7B…FA6A

    Re-read on the chain (2026-10-31 02:21 UTC): 5 validated payments totalling 233,461,943 XRP between 2026-10-29T20:05:00Z and 2026-10-29T20:09:20Z

    Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map · XRPScan: transaction · as of 2026-10-30 12:28 UTC

Addresses in this lane (2)
LabelChainAddressNote and source
XRP receiver
receiver		XRP LedgerrK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMxAccount that did not exist a minute earlier. Has never sent a transaction.
holds 233,461,943 XRP at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map
Binance XRP accounts ×5
victim		XRP Ledger
5 addresses
  • rDAE53VfMvftPB4ogpWGWvzkQxfht6JPxr
  • rBtttd61FExHC68vsZ8dqmS3DfjFEceA1A
  • rfQ9EcLkU6WnNmkS3EwUkFeXeN47Rk8Cvi
  • rarG6FaeYhnzSKSS5EEPofo4gFsPn2bZKk
  • rNU4eAowPuixS5ZCWaRL72UUeKgxcKExpK
Each account was left with its minimum balance.
Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map

Solana

1 actions1 chain-checked

Solana: about 970,500 SOL, about $96M. TRM Labs analysis · Bitquery investigation

ORIGIN+1 HOP ✓TRANSFER965,455 SOLBinance Solana hot wallet, 5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9Binance SOL hot5tzFkiKs…uAi9Solana receiver, AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaUSolana receiverAffzFDKZ…BEaU✓
Actions in time order (1)
  1. Transfer
    Binance Solana hot wallet 5tzFkiKs…uAi9 Solana receiver AffzFDKZ…BEaU
    965,455.1 SOL in the first transferSOL
    Chain-checked Analyst / chain data
    Details and sources

    Reports total about 970,500 SOL, so smaller transfers followed. The Solana drain shares no address with the rest of the attack (Bitquery).

    Solana transaction 5YvwLFWu…Tqk2

    Re-read on the chain (2026-10-31 02:21 UTC): 965,455 SOL transferred at 2026-10-29T20:10:18Z

    Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map · Solscan: transaction · as of 2026-10-30 12:28 UTC

Addresses in this lane (2)
LabelChainAddressNote and source
Solana receiver
receiver		SolanaAffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaUHas never sent a transaction.
holds 970,554 SOL at check time (2026-10-31 02:21 UTC)
Sources: Bitquery investigation · TRM Labs analysis · Blockaid live fund-flow map
Binance Solana hot wallet
victim		Solana5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9
Sources: Bitquery investigation · Blockaid live fund-flow map

Other chains

14 actions1 chain-checked9 two reports3 one report1 unverified

Other chains: Arbitrum, Optimism and Base about $39M together, Avalanche about $28M, Polygon about $10M (TRM). The Blockaid map adds a NEAR collector with $53.9M that TRM and Bitquery do not list. TRM Labs analysis · Blockaid live fund-flow map

ORIGIN+1 HOP+2 HOPS+3 HOPS 2TRANSFER46.6M POL 2TRANSFER$2.9M 2CROSS-CHAIN1.56M USDC 1TRANSFER44.2M OP ?TRANSFER$53.9M 2TRANSFER444,537 AVAX 1TRANSFER2.06M AVAX 2TRANSFER1.81M AVAX 2TRANSFER8,426 ETH + ARB ✓RESCUE8,426 ETH + ARB 1TRANSFER$13.8M 2TRANSFERETH + ARBBinance Arbitrum wallets ×4Binance ARB ×44 addressesBinance Avalanche wallets ×4Binance AVAX ×44 addressesBinance 113 (Avalanche), 0x978b21a854dbefcd6d51dfd269875d158046240bBinance 1130x978b21…240bBinance 55 (Optimism), 0xacd03d601e5bb1b275bb94076ff46ed9d753435aBinance 55 (OP)0xacd03d…435aBinance 73 (Base), 0x3304e22ddaa22bcdc5fca2269b418046ae7b566aBinance 73 (Base)0x3304e2…566aBinance NEAR wallets ×3Binance NEAR ×33 addressesBinance Polygon hot wallet, 0xe7804c37c13166ff0b37f5ae0bb07a3aebb6e245Binance POL hot0xe7804c…e245Main receiver on other chains, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8cReceiver, 5 chains0x5227f6…2f8cNEAR collector, efd224256518a7cacd209867963276efed302a8e222c013c43f4b1bd369ae5afNEAR collectorefd22425…e5afArbitrum wallet (emptied by Council), 0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5Arbitrum wallet0x3e2bf1…32d5Avalanche AVAX holder, 0x80358c5b8f9b2cc27147a1e0f2a6c9a30eb2c397AVAX holder0x80358c…c397CCTP landing wallet (Ethereum), 0xc39e690bea48448cc47e7acddfe30e6453e09824CCTP landing0xc39e69…9824Arbitrum Security CouncilSecurity CouncilserviceAvalanche relay wallets ×11AVAX relays ×1111 addressesFROZEN · Circle1.56M USDCFROZEN · Tether8.4M + 6.2M
Actions in time order (14)
  1. Minute precision on the map
    Transfer
    Binance NEAR wallets ×3 NEAR collector efd22425…e5af
    $53.9M (at the map's prices)Mixed assets
    Unverified Analyst / chain data
    Details and sources

    Only the Blockaid map reports NEAR. TRM and Bitquery do not list this chain, so the report is not confirmed by a second publisher.

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  2. Minute precision on the map
    Transfer
    Binance 73 (Base) 0x3304e2…566a Main receiver on other chains 0x5227f6…2f8c
    $2.9M (at the map's prices)Mixed assets
    Two reports Analyst / chain data
    Details and sources

    TRM: Arbitrum, Optimism and Base together about $39M.

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  3. Minute precision on the map
    Transfer
    Binance 55 (Optimism) 0xacd03d…435a Main receiver on other chains 0x5227f6…2f8c
    44.2M OPOP
    One report Analyst / chain data
    Details and sources

    Within 12 minutes of the first Ethereum sweep (Blockaid).

    Sources: Blockaid investigation · Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  4. Minute precision on the map
    Transfer
    Binance Arbitrum wallets ×4 Main receiver on other chains 0x5227f6…2f8c
    8,426 ETH + 74.6M ARBETH, ARB
    Two reports Analyst / chain data
    Details and sources

    From four Binance hot wallets on Arbitrum.

    Sources: Blockaid investigation · Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  5. Minute precision on the map
    Transfer
    Binance Avalanche wallets ×4 Main receiver on other chains 0x5227f6…2f8c
    About 1.81M AVAX + 8.41M USDTAVAX, USDT
    Two reports Analyst / chain data
    Details and sources

    Sources: Blockaid investigation · Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  6. Minute precision on the map
    Transfer
    Main receiver on other chains 0x5227f6…2f8c Avalanche AVAX holder 0x80358c…c397
    About 2.06M AVAXAVAX
    One report Analyst / chain data
    Details and sources

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  7. Second wave about 23:05 UTC (TRM)
    Transfer
    Binance 113 (Avalanche) 0x978b21…240b Main receiver on other chains 0x5227f6…2f8c
    444,537 AVAXAVAX
    Two reports Analyst / chain data
    Details and sources

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  8. Polygon drain 23:05 UTC (Bitquery, TRM)
    Transfer
    Binance Polygon hot wallet 0xe7804c…e245 Main receiver on other chains 0x5227f6…2f8c
    46.6M POL + 6.19M USDTPOL, USDT
    Two reports Analyst / chain data
    Details and sources

    Sources: Blockaid live fund-flow map · TRM Labs analysis · Bitquery investigation · as of 2026-10-30 12:28 UTC

  9. Minute precision on the map
    Cross-chain
    Main receiver on other chains 0x5227f6…2f8c CCTP landing wallet (Ethereum) 0xc39e69…9824
    1.56M USDC through Circle CCTPUSDC
    Two reports Analyst / chain data
    Details and sources

    TRM: swapped from AVAX, bridged from Avalanche to Ethereum, then frozen by Circle.

    Sources: Blockaid live fund-flow map · TRM Labs analysis · as of 2026-10-30 12:28 UTC

  10. Rescue
    Arbitrum wallet (emptied by Council) 0x3e2bf1…32d5 Arbitrum Security Council
    8,426 ETH + 74.6M ARB moved out of the attacker's reachETH, ARB
    Chain-checked Analyst / chain data
    Details and sources

    The chain shows 8,425.998 ETH leaving the wallet in a forced transfer (transaction type 0x65, no signature). TRM gives 00:08 UTC; the chain timestamp is 00:18:20. The ARB part is in a separate transaction that the reports do not give.

    Arbitrum transaction 0x410af1…5f70

    Re-read on the chain (2026-10-31 02:21 UTC): block 519514685 at 2026-10-30T00:18:20Z; status success; sender matches; time matches; value 8,426 ETH

    Sources: Bitquery investigation · TRM Labs analysis · Arbitrum post (X) · Arbiscan: transaction · as of 2026-10-30 12:28 UTC

  11. Minute precision on the map
    Transfer
    Avalanche AVAX holder 0x80358c…c397 Avalanche relay wallets ×11
    $13.8M to 11 relay walletsAVAX
    One report Analyst / chain data
    Details and sources

    Still holding about $43K there.

    Sources: Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  12. time not stated
    Transfer
    Main receiver on other chains 0x5227f6…2f8c Arbitrum wallet (emptied by Council) 0x3e2bf1…32d5
    ETH and ARB moved to the wallet the Council emptiedETH, ARB
    Two reports Analyst / chain data
    Details and sources

    Time not stated

    Sources: Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-30 12:28 UTC

  13. time not stated
    Freeze
    Circle (issuer) 🔒→ CCTP landing wallet (Ethereum) 0xc39e69…9824
    1.56M USDC frozenUSDC
    Two reports Analyst / chain data
    Details and sources

    Time not stated

    TRM: Circle froze it later than the main freeze.

    Sources: TRM Labs analysis · Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

  14. time not stated
    Freeze
    Tether (issuer) 🔒→ Main receiver on other chains 0x5227f6…2f8c
    8.4M USDT on Avalanche, 6.2M USDT0 on PolygonUSDT
    Two reports Analyst / chain data
    Details and sources

    Time not stated

    The map notes USDT frozen in place on the receiver. The two amounts are from TRM.

    Sources: TRM Labs analysis · Blockaid live fund-flow map · as of 2026-10-30 12:28 UTC

Addresses in this lane (13)
LabelChainAddressNote and source
Arbitrum wallet (emptied by Council)
hop		Arbitrum0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5
Sources: Bitquery investigation · Blockaid live fund-flow map
Binance Arbitrum wallets ×4
victim		Arbitrum
4 addresses
  • 0xb38e8c17e38363af6ebdcb3dae12e0243582891d
  • 0xf92402bb795fd7cd08fb83839689db79099c8c9c
  • 0x1b5b4e441f5a22bfd91b7772c780463f66a74b35
  • 0x3931dab967c3e2dbb492fe12460a66d0fe4cc857

Sources: Blockaid investigation · Blockaid live fund-flow map
Avalanche AVAX holder
stash		Avalanche0x80358c5b8f9b2cc27147a1e0f2a6c9a30eb2c397About 2.06M AVAX; later forwarded to relay wallets (map).
Sources: Blockaid live fund-flow map
Binance Avalanche wallets ×4
victim		Avalanche
4 addresses
  • 0x3bce63c6c9abf7a47f52c9a3a7950867700b0158
  • 0xaba2d404c5c41da5964453a368aff2604ae80a14
  • 0x6d8be5cdf0d7dee1f04e25fd70b001ae3b907824
  • 0x9f8c163cba728e99993abe7495f06c0a3c8ac8b9

Sources: Blockaid investigation · Blockaid live fund-flow map
Avalanche relay wallets ×11
hop		Avalanche
11 addresses
  • 0x2ef0f69cb884a0bd8a64a6cf88c61e716f87f033
  • 0x62b16e7eb76be5adbe544659cf246ff870ffc82e
  • 0xa32668de8843533dd15af7f29cfaacdfdc42a675
  • 0xad456c79732e0e0b2fc1d1368b9069b4bb08e8b5
  • 0x1192093ad796156e29025af779542d6de62d7a16
  • 0x13723799ec02d2ab3933be11c7eb7c9904eac7c1
  • 0x4bd7a51d216e7d406811b11ffc8e1caad452b29f
  • 0x554d2a66aa6f5d4b6fd23b649270f011072b4771
  • 0x56c3b3224973dc7240877e630f37a160a5332714
  • 0x6abec14ec8dba805c3bc2e9133214a3c7688cc3f
  • 0xb77d96c8676abdb1b2eec3a5a41a028e8e722c61

Sources: Blockaid live fund-flow map
Binance 113 (Avalanche)
victim		Avalanche0x978b21a854dbefcd6d51dfd269875d158046240bPart of the second wave at 23:04 UTC.
Sources: Blockaid live fund-flow map · TRM Labs analysis
Binance 55 (Optimism)
victim		Optimism0xacd03d601e5bb1b275bb94076ff46ed9d753435a
Sources: Blockaid investigation · Blockaid live fund-flow map
Binance 73 (Base)
victim		Base0x3304e22ddaa22bcdc5fca2269b418046ae7b566a
Sources: Blockaid live fund-flow map · TRM Labs analysis
CCTP landing wallet (Ethereum)
frozen		Ethereum0xc39e690bea48448cc47e7acddfe30e6453e09824USDC bridged from Avalanche through Circle CCTP. 1.56M USDC frozen.
Sources: Blockaid live fund-flow map · TRM Labs analysis
NEAR collector
holding		NEARefd224256518a7cacd209867963276efed302a8e222c013c43f4b1bd369ae5af
Sources: Blockaid live fund-flow map
Binance NEAR wallets ×3
victim		NEAR
3 addresses
  • 5c33c6218d47e00ef229f60da78d0897e1ee9665312550b8afd5f9c7bc6957d2
  • 9c484fa5d2d069569ba063fc555c34e621ccd88fdbb0295fc79bad232621c5c1
  • 451913e633c72fb951effe076d3bd2977e3f08083dcf6c87fa89992b0d437c5c
Only the Blockaid map reports NEAR. TRM and Bitquery do not.
Sources: Blockaid live fund-flow map
Binance Polygon hot wallet
victim		Polygon0xe7804c37c13166ff0b37f5ae0bb07a3aebb6e245Part of the second wave at 23:04 UTC.
Sources: Blockaid live fund-flow map · TRM Labs analysis · Bitquery investigation
Main receiver on other chains
receiver		Several chains0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
same address on Optimism, Arbitrum, Avalanche, Polygon, Base		Same address as the Ethereum main receiver. Holds OP, POL and other native coins; issuers froze USDT in place (map).
Sources: Blockaid investigation · Blockaid live fund-flow map

Not verified 5

Reports we could not tie to an address or transaction that a reader can look up, or where sources disagree. They are shown on the map and in the lists, marked Unverified. We did not fill the gaps.

What the record shows, and what it does not

  • TRM Labs attributes the attack to the North Korea-linked group TraderTraitor. This site does not confirm the attribution. The chain shows who sent each transaction, not who controlled the signer. TRM Labs analysis · as of 2026-10-30 19:41:23 UTC
  • Binance says an engineer's laptop was compromised and no wallet private key leaked. On 16 of 17 wallets the chain shows ordinary signed transfers, so the signing was Binance's own system. The record does not show who asked it to sign. Bitquery investigation · TRM Labs analysis · as of 2026-10-30 07:12 UTC
  • Time of the Arbitrum rescue: TRM gives 00:08 UTC. The chain timestamp of the rescue transaction is 00:18:20 UTC, which matches Bitquery and the Blockaid map. TRM Labs analysis · Bitquery investigation · as of 2026-10-31 02:15 UTC
  • Binance 16: Blockaid lists 55.7M USDT, 25.9M RLUSD and 84.5 WBTC together with its 28,005.6 ETH. The logs of that transaction hold no token transfers, so the tokens moved in other transactions that the reports do not give. Blockaid investigation · as of 2026-10-31 02:15 UTC
  • Bitcoin lots: Bitquery lists 17 lots of 1,000 BTC plus lots of 832.5 and 437.7 BTC (19 addresses). Blockaid counts 16 lots of 1,000 BTC. This page follows the Bitquery address list. The chain shows all 19 addresses unspent. Bitquery investigation · Blockaid live fund-flow map · as of 2026-10-31 02:15 UTC
  • TRON hop: TRM says 300M USDT was supplied to JustLend. The Blockaid map and Bitquery show a swap to TRX on SunSwap from the same wallet. The chain shows the JustLend receipt token arriving at 21:14:57 UTC. The swap is reported by the map and Bitquery only. TRM Labs analysis · Blockaid live fund-flow map · Bitquery investigation · as of 2026-10-31 02:15 UTC
  • Stash amounts: Bitquery and the Blockaid map give what each stash holds in total, for example 137,602 ETH. The transfers that filled a stash are smaller and may be several, for example 122,310 ETH in one transfer. This page shows the amount found on the chain on the action and the stash total on the address. Bitquery investigation · Blockaid live fund-flow map · as of 2026-10-31 02:15 UTC
  • No transfer to a known exchange, mixer or bridge was found from the wallets Bitquery followed. Its last reading was 06:43 UTC on 30 October. The Blockaid map reports later bridge use on TRON, shown as an edge above. Bitquery investigation · Blockaid live fund-flow map · as of 2026-10-30 06:43 UTC

How the actions were checked

  • Every action cites a security-firm report (Blockaid, Bitquery, TRM Labs) or an issuer's own post. Where a transaction is known, a block-explorer link is added.
  • 50 claims were re-read by this site on 2026-10-31 02:21 UTC through public read-only JSON-RPC and REST endpoints (Ethereum, Arbitrum, Bitcoin, TRON, XRP Ledger, Solana). Nothing was signed or sent. The result of each read is on its action, under "Details and sources".
  • The re-reads can be repeated with node scripts/verify-flow.mjs from the open-source repository.
  • A check confirms that a transaction exists with the stated sender, recipient, time and amount. It does not confirm who controls an address.

Follow the money on other trackers

Independent public pages that show this incident or its addresses. Each link opens a third-party site that we do not control.

  • Blockaid Risk Exposure map ↗Hop-by-hop map of the traced attacker addresses on nine chains, with a paste-in checker for your own addresses. Source of many hops on this page.updated 2026-10-30 12:28 UTC · checked 2026-10-31 02:15 UTC
  • Bitquery on-chain investigation ↗Chain-by-chain trace of the drain: $6.3B out on nine chains, $2.7B frozen, where the rest sits (figures as of 2026-10-30).updated 2026-10-30 07:12 UTC · checked 2026-10-31 00:40 UTC
  • Blockaid investigation ↗Detection time, EIP-7702 delegation mechanism and the first sweep.updated 2026-10-30 18:46:41 UTC · checked 2026-10-31 00:40 UTC
  • Etherscan: collection address ↗Live balance and transfers of the collection address. The explorer blocks automated checks, so the link was not opened by a script.update time not stated · checked 2026-10-31 00:40 UTC
  • TRM Labs analysis ↗Blockchain-intelligence write-up with fund movement and attribution. The attribution is TRM Labs' claim, not confirmed by this site.updated 2026-10-30 19:41:23 UTC · checked 2026-10-31 00:40 UTC